For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Srini_87152's avatar
Srini_87152
Icon for Cirrostratus rankCirrostratus
Oct 14, 2015

Overlapping emails for active sync

Team,

 

We had issue for Active sync users saying they are getting emails from other user IDs..only behavior noticed they are using same password with different user names..

 

This overlapping email happening all mobile users who are have same password.

 

we are running 11.4.1 HF8...please let me know if any one had known issues or appreciate any help here.

 

BIG-IP Access Policy Manager (APM)
security

5 Replies

  • R_Marc's avatar
    R_Marc
    Icon for Nimbostratus rankNimbostratus
    Oct 14, 2015

    I had this same issue. If you are using the Active Sync iRule provided by F5 (well, it kinda sucks).

     

    They are creating a persistence cookie (sort of) by hashing the IP address of the client. If you have users that are NAT'd to the same IP, they'll end up with crossed streams, and if ghostbusters taught us anything it was to never cross streams.

     

    I'll go dig up what I did to fix this, assuming my assumptions are correct that you are using the stock active sync iRule.

     

  • Seth_Cooper's avatar
    Seth_Cooper
    Icon for Employee rankEmployee
    Oct 15, 2015

    Hi! I believe you are running into ID 479451 which is a known issue.

     

    This is fixed in 11.5.3 HF-2, 11.6.0 HF-4, and 12.0.0 so if you upgrade to any of those releases with the latest hotfix this should resolve your issue.

     

    Seth

     

  • Srini_87152's avatar
    Srini_87152
    Icon for Cirrostratus rankCirrostratus
    Oct 16, 2015

    Thanks Mark and Seth..

     

    As part of my test environment troubleshooting ,following rule making mess. After remove rule..all working as expected.no email overlapping....not sure this rule really require?

     

    Can some one explain about this rule and advantages adding to VIP? iam more concern about if remove on my Prod environment not sure how traffic will behave.

     

    when ACCESS_ACL_ALLOWED { set sessionid [ACCESS::session data get "session.user.sessionid"] HTTP::header insert APM_session $sessionid } when HTTP_RESPONSE { if { [string tolower [HTTP::header values "WWW-Authenticate"]] contains "negotiate"} { ONECONNECT::reuse disable ONECONNECT::detach disable NTLM::disable } if {[HTTP::header exists "Transfer-Encoding"]} { HTTP::payload rechunk } }

     

  • Srini_87152's avatar
    Srini_87152
    Icon for Cirrostratus rankCirrostratus
    Oct 16, 2015

    Seth,

     

    I have reviewed the 479451 and found solution SOL16737 for fix on 11.5.3 HF2..might i will review and test..

     

    Thank fro the information..

     

    Srini